Archive
Highlighted

how to set the log size limit

Path Finder

how to set the log size limit? how to make automatic deletion for the log collected

Tags (1)
0 Karma
Highlighted

Re: how to set the log size limit

Influencer

Hi,
In this log have a look at batch inputs. A batch input will delete the file you want to read afterwards.

What do you mean by log size? Are ww talking boit a splunk log like splunkd.log? Or are you referring to a log you want to monitor?

    [batch://<path>] 
    move_policy = sinkhole 
    <attrbute1> = <val1> 
    <attrbute2> = <val2>

https://docs.splunk.com/Documentation/SplunkCloud/7.1.3/Data/Monitorfilesanddirectorieswithinputs.co...

Highlighted

Re: how to set the log size limit

Path Finder

referring to the log I want to monitor

0 Karma
Highlighted

Re: how to set the log size limit

Influencer

HI,

I think that depends on what you want to log. Why do you want to set the size?

Did you try batch:// input?

0 Karma
Highlighted

Re: how to set the log size limit

Path Finder

where is batch://input
I afraid the log size would be too big

0 Karma
Highlighted

Re: how to set the log size limit

Influencer

HI, splunk can handle logs with big size too. Depends more on your queue size and your network, how fast it will ingest the data.

You are monitoring with a universal forwarder?

You can set the batch input your self, in any inputs.conf in $SPLUNK_HOME/splunk/etc/apps

just create a new app with a local folder and within the local folder create an inputs.conf.

Then paste the code I gave you above and replace ://path with your file path. Then restart splunk.

0 Karma
Highlighted

Re: how to set the log size limit

Influencer

Was this helpfull?

0 Karma
Highlighted

Re: how to set the log size limit

SplunkTrust
SplunkTrust

Hi

well it is possible, you can configure index size limit as the logs are stored in indexes.
have a look at this doc:
https://docs.splunk.com/Documentation/Splunk/7.2.3/Indexer/Configureindexstoragesize

let me know if it helps!

0 Karma
Highlighted

Re: how to set the log size limit

Esteemed Legend

You can set the maximum event size with the TRUNCATE setting.

0 Karma